Re: rm-ing files with open file descriptors

[Miquel van Smoorenburg <miquels@cistron.nl>]

In article <Pine.GSO.4.21.0201190627310.3523-100000@weyl.math.psu.edu>,
Alexander Viro  <viro@math.psu.edu> wrote:
>On Sat, 19 Jan 2002, Miquel van Smoorenburg wrote:
> 
>> This could be hacked around ofcourse in fs/namei.c, so I tried
>> it for fun. And indeed, with a minor correction it works:
>> 
>> % perl flink.pl 
>> Success.
>> 
>> I now have a flink-test2.txt file. That is pretty cool ;)
>
>It's also a security hole.

How is linking back a file into the normal namespace anymore
a security hole as having it under /proc or keeping an fd to it open?

I've searched google on the subject but couldn't find anything relevant.
Yes this has been proposed a few times for both BSD and Linux, often
in combination with "unattached open" (O_NULL or somesuch) that opens
a file with a nlink count of 0. It's supposed to be a perfect way to
create a new file and link it atomically into place without creating
(named) tempfiles.

Mike.